Digital systems are now central to sales, finance, human resources, operations, communication and customer service. Their value also makes them attractive targets. A malicious actor may steal credentials, encrypt files, manipulate transactions, interrupt services or misuse personal information. Cybersecurity is therefore not only a technical concern: it is a business responsibility involving governance, people, processes and technology.

This chapter examines how organizations identify and manage common cyber threats, protect information and continue operating when controls fail. It distinguishes cybersecurity from privacy, explains practical safeguards, and connects incident response with business continuity and disaster recovery.

Learning Objectives

1. Cybersecurity, Privacy and Resilience

Cybersecurity is the protection of computers, networks, applications and data against unauthorized access, alteration, disclosure, destruction or disruption. The classic security objectives are often summarized as the CIA triad:

A payroll system that exposes salaries fails confidentiality; one that changes salary values without authorization fails integrity; and one that is unavailable on payday fails availability. A control can improve one objective while creating a trade-off. For example, extensive authentication may improve confidentiality but, if poorly designed, reduce availability for legitimate users.

Privacy concerns the appropriate collection, use, sharing, retention and disposal of information about identifiable people. Security protects information from threats; privacy asks whether the organization should collect or use the information in the first place and whether it is doing so fairly and lawfully. Encryption may secure an employee database, but it does not justify collecting unnecessary employee information.

Resilient computing is the capability of a system or organization to anticipate disruption, resist or absorb its effects, recover essential services and learn from the event. Resilience assumes that prevention is valuable but not perfect. It therefore combines protective controls with preparation, redundancy, response and recovery.

2. Threats, Vulnerabilities and Risk

A threat is a potential cause of harm, such as a criminal group, careless employee, equipment failure or natural disaster. A vulnerability is a weakness that a threat can exploit. Examples include an unpatched operating system, a weak password, excessive user privileges, an exposed network service or an untested backup. An attack is an intentional attempt to exploit a vulnerability. An asset is something valuable to the organization, including data, hardware, software, reputation and business processes.

Risk exists when a threat can exploit a vulnerability and cause an unacceptable consequence. A simple qualitative model is:

Likelihood expresses the chance or frequency of an event, while impact expresses the resulting harm. This is a prioritization model, not a precise law of nature. Organizations may use categories such as low, medium and high rather than numerical values. Risk treatment options are to avoid the activity, reduce the likelihood or impact, transfer part of the risk through contracts or insurance, or accept it knowingly within approved limits.

A vulnerability assessment identifies weaknesses; a penetration test authorizes controlled attempts to exploit selected weaknesses; and a risk assessment considers assets, threats, likelihood, impact and existing controls. These activities are related but not identical. A vulnerability scanner may detect an obsolete service, whereas a penetration test may demonstrate what an attacker could reach through it.

3. Malware and Common Attacks

Malware is software designed to harm systems, gain unauthorized access, spy on users or perform unauthorized actions.

Malware commonly enters through deceptive email attachments, compromised websites, unapproved software, removable media, stolen credentials or vulnerable internet-facing systems. Effective defense uses layered controls: secure configuration, endpoint protection, application allow-listing where appropriate, least privilege, user education, patching, network segmentation, logging and tested recovery.

A denial-of-service (DoS) attack attempts to make a service unavailable. A distributed denial-of-service (DDoS) attack uses many sources, often a botnet, to overwhelm bandwidth, connection capacity or application resources. Mitigation may include rate limiting, traffic filtering, content-delivery services, redundant architecture and communication with an internet service provider.

In web applications, an attacker may exploit injection, in which untrusted input is interpreted as a command or query. A classic example is SQL injection against a database. Parameterized queries, input validation, appropriate error handling and least-privilege database accounts reduce this risk. Cross-site scripting (XSS) occurs when an application causes a user’s browser to execute attacker-controlled script; output encoding, content-security policies and secure development practices help prevent it.

Man-in-the-middle attacks occur when an attacker intercepts or alters communication between two parties. Secure protocols, certificate validation, protected networks and multi-factor authentication reduce exposure. Users should not assume that a familiar network name or website appearance proves authenticity.

4. Social Engineering and Human Behavior

Technical defenses can be defeated by manipulating people. Social engineering is the use of deception, pressure or trust to obtain information, access or an action.

Phishing uses fraudulent messages to induce a victim to click a link, open an attachment or disclose credentials. Spear phishing targets a particular person or organization using customized information. Whaling focuses on senior executives or high-value individuals. Business email compromise may impersonate an executive or supplier and request an urgent payment or change to bank details. Smishing uses text messages, while vishing uses voice calls. Pretexting creates a false story, and baiting offers something attractive in order to induce unsafe behavior. Tailgating occurs when an unauthorized person follows an authorized person into a restricted area.

Warning signs include unusual urgency, secrecy, requests to bypass normal approval, unexpected links or attachments, mismatched domains, changes in payment instructions and appeals to authority. Sensible responses are to verify through an independent channel, avoid using contact details supplied in the suspicious message, report the event, and preserve evidence. Organizations should design processes that make safe behavior easy: dual approval for payments, clear reporting channels, security awareness training, simulated exercises and a culture in which employees are not punished for promptly reporting mistakes.

5. Authentication and Access Control

Authentication verifies identity. Authorization determines what an authenticated identity may do, and accounting or auditing records relevant activity. Confusing these concepts can produce serious control failures.

Factor	Example	Limitation
Knowledge	Password or PIN	Can be guessed, reused or disclosed
Possession	Security key or authenticator device	Can be lost or stolen
Inherence	Fingerprint or face characteristic	Difficult to replace if compromised
Location or context	Approved network or device posture	Location can be misrepresented

Multi-factor authentication (MFA) uses two or more different factors. A password plus a second code from the same password database is not genuinely two-factor authentication. Hardware security keys and passkeys can provide strong resistance to phishing because they bind authentication to the legitimate website or service.

Good password practice includes long, unique passwords, password managers, breached-password screening and protection against repeated login attempts. Passwords should be stored as salted, slow cryptographic hashes rather than plaintext. Least privilege gives each user only the access required for assigned duties. Role-based access control assigns permissions to job roles, while separation of duties ensures that one person cannot independently initiate and approve a sensitive transaction.

Access should be reviewed periodically and removed promptly when a person changes role or leaves. Privileged accounts require stronger monitoring and should not be used for routine email or browsing. A zero-trust approach avoids automatically trusting a user or device merely because it is inside a corporate network; access is continuously evaluated using identity, device condition, context and requested resource.

6. Encryption and Data Protection

Encryption transforms readable plaintext into ciphertext using an algorithm and a key. Decryption reverses the process for an authorized recipient. Confidentiality depends not merely on hiding an algorithm but on protecting keys and selecting reputable, correctly implemented cryptography.

Symmetric encryption uses the same secret key to encrypt and decrypt data. It is efficient for large data volumes, but the key must be shared securely. Asymmetric encryption uses a public key and a private key. A sender can encrypt with the recipient’s public key, while only the corresponding private key should decrypt. Asymmetric techniques also support digital signatures: a signature created with a private key can be checked with the public key, providing evidence of origin and integrity when trust in the key is established.

In practice, systems often use hybrid encryption: asymmetric cryptography establishes or protects a temporary symmetric session key, and symmetric encryption protects the actual data. Hashing is different from encryption. A cryptographic hash produces a fixed-length digest intended for integrity checking; it is not designed to be decrypted. Password storage uses a salted, deliberately expensive password-hashing function rather than a fast general-purpose hash.

Encryption should protect data in transit, such as through properly configured transport security, and at rest, such as on laptops, servers and backup media. Organizations must manage key generation, storage, rotation, access, backup and revocation. Lost keys can make legitimate data permanently inaccessible; stolen keys can undermine otherwise strong encryption.

Privacy protection also requires data minimization, purpose limitation, retention schedules, access transparency and secure disposal. Personal information should be collected for a legitimate, specified purpose and retained no longer than necessary, subject to applicable law and business requirements. Organizations should identify sensitive data, restrict exports, monitor unusual access and assess vendors that process personal information.

7. Patching, Secure Configuration and Firewalls

A patch is an update that fixes defects, including security vulnerabilities. Patch management is the controlled process of inventorying assets, assessing updates, testing them, deploying them according to risk and verifying completion. Delaying a critical patch on an internet-facing system can leave a known weakness exploitable; deploying an untested update everywhere without a rollback plan can also cause disruption.

A practical patch process includes an accurate asset inventory, vulnerability severity assessment, testing in a representative environment, prioritized deployment, exception approval, verification and documentation. Unsupported operating systems and applications create special risk because fixes may no longer be available. Virtual machines, mobile devices, cloud services and embedded equipment should be included in the inventory.

Secure configuration removes unnecessary services, changes default credentials, restricts administrative interfaces, enables logging, applies access controls and uses approved configuration baselines. Configuration drift—gradual divergence from an approved state—can reopen weaknesses even after patching.

A firewall controls network traffic according to rules involving addresses, ports, protocols, applications or identity. A network firewall may separate internal and external networks; a host firewall protects an individual device. Modern firewalls may inspect application behavior, but no firewall can correct a compromised password, malicious insider or vulnerable application by itself. Rules should follow deny-by-default where practical, permit only required traffic, be documented, reviewed and monitored, and avoid unnecessary exposure of management interfaces.

Network segmentation limits the movement of an attacker. For example, guest wireless access should not provide direct access to finance servers, and critical systems should be separated from ordinary user workstations. Segmentation reduces blast radius but must be combined with authentication and monitoring because attackers may still compromise an authorized segment.

8. Backups and Recovery

A backup is a separate copy of data or system information that can be used to restore operations. Important distinctions include:

The 3-2-1 principle recommends at least three copies, on two different types of media, with at least one copy off-site. Modern practice often adds immutability or offline protection and routine restoration tests. A backup that has never been restored successfully is an assumption, not reliable recovery capability.

RPO = maximum acceptable period of data loss measured backward from the disruption

RTO is a time duration. RPO is also a time duration, but it describes how recent the restored data must be. If an organization sets an RPO of 15 minutes, it must be prepared for the possibility of losing up to 15 minutes of transactions, depending on the incident and backup design. Lower RTO and RPO targets generally require greater investment in redundancy, replication, staffing and testing.

For example, if an online order system has an RTO of two hours and an RPO of 15 minutes, recovery planning must restore service within two hours and provide data no older than 15 minutes before the disruption. A nightly backup alone cannot meet that RPO. A business may instead use frequent replication plus protected snapshots, while recognizing that replication can copy corruption or ransomware and therefore does not replace independent backups.

9. Incident Response

An incident is an event that threatens confidentiality, integrity or availability, or violates security policy. Incident response is a coordinated process for limiting harm and restoring trustworthy operations. A common lifecycle is:

Response must balance speed with evidence preservation. Immediately wiping a compromised computer may remove useful evidence, while delaying isolation may allow further damage. The response team should coordinate technical actions with management, legal counsel, privacy officers, communications and affected business units. External reporting may be required by law, contract, regulation or sector rules. Notifications should be accurate, timely and avoid speculative claims.

Logs should be protected against unauthorized alteration and retained according to operational, legal and privacy requirements. Incident playbooks for ransomware, lost devices, credential theft and data leakage make response more consistent. Tabletop exercises test decisions without causing a real outage; technical recovery exercises test whether systems can actually be restored.

10. Business Continuity and Disaster Recovery

Business continuity management (BCM) addresses how critical products and services continue during disruption. It includes people, facilities, suppliers, communications, workarounds and technology. Disaster recovery (DR) is the technology-focused and operational capability to restore systems, applications and data after a disruptive event. DR is part of continuity, not a substitute for it.

A business impact analysis (BIA) identifies important activities, dependencies, tolerable downtime, data requirements, legal obligations and consequences of interruption. It may reveal that a customer-support process can operate manually for one day, while payment settlement must resume within minutes. Recovery priorities should be based on business impact rather than on the convenience of the IT department.

Continuity strategies include alternate facilities, remote-work arrangements, redundant suppliers, manual procedures, high-availability systems, spare equipment, cloud recovery services and cross-training. A hot site is prepared for rapid operation; a warm site has some infrastructure but requires preparation; a cold site provides space or basic facilities and requires more rebuilding. Their cost and recovery speed differ.

Resilience also depends on dependencies. A company may have redundant servers but only one payment provider, internet carrier, administrator or physical location. Supplier contracts should address security responsibilities, notification, recovery capabilities, data return and termination. Recovery plans must specify decision authority, communication methods, restoration order, validation tests and criteria for declaring normal operations.

11. Governance, Ethics and Professional Practice

Security decisions affect employees, customers, shareholders and society. Monitoring may help detect misuse but can intrude on employee privacy. Biometric authentication can improve convenience but creates sensitive data risks because a compromised biometric characteristic cannot simply be replaced like a password. Managers should apply proportionality, transparency, purpose limitation and access controls.

Organizations should assign accountability through policies, risk registers, control owners and audit processes. Security frameworks and standards can structure governance, but compliance is not identical to security. A firm may satisfy a checklist while leaving an important business process unprotected. Senior management must fund controls according to risk and ensure that security objectives support, rather than unnecessarily obstruct, business objectives.

Ethical practice requires authorization before security testing, responsible handling of discovered vulnerabilities, confidentiality of investigation data and avoidance of unnecessary harm. Employees should understand acceptable-use rules, reporting obligations and consequences for deliberate misuse. Artificial intelligence can assist anomaly detection, malware classification and alert prioritization, but it may generate false positives, reproduce bias or expose sensitive data. Human review, access controls, explainability appropriate to the decision and testing against adversarial manipulation remain necessary.

12. Illustrative Case: Riverside Retail Group

Background

Riverside Retail Group, a fictional medium-sized retailer, operates online sales, stores and a central finance system. It has 180 employees, uses cloud email and performs nightly backups to a network-attached device.

Problem

An accounts employee receives a convincing supplier message requesting an urgent change to bank details. The employee clicks a link and enters credentials on a fraudulent site. The attacker accesses email, creates a forwarding rule, and later deploys ransomware through a remote administration account. Several file servers become unavailable.

Analysis

The incident combines spear phishing, credential theft, excessive privilege, inadequate MFA, weak monitoring and insufficiently isolated backups. The nightly backup device is connected with an account that the attacker can reach, so some backups are encrypted as well. The organization’s BIA shows that online sales should resume within eight hours (RTO = 8 hours), while finance can operate manually for 48 hours. The business can tolerate at most four hours of order-data loss (RPO = 4 hours).

Approach and Solution

The response team isolates affected systems, disables compromised accounts, preserves email and endpoint evidence, and contacts its incident-response provider. It verifies the scope before rebuilding systems from a clean baseline. Payment instructions are independently verified, and customers are informed only after facts and legal obligations are assessed.

For prevention, Riverside introduces phishing-resistant MFA for privileged and finance accounts, least-privilege administration, email authentication controls, payment-change dual approval, endpoint detection, network segmentation and a formal patch process. It replaces the connected backup design with encrypted immutable snapshots and an offline copy, then performs restoration tests. A continuity exercise validates manual order capture and alternate communications.

Outcome

Online sales resume within the eight-hour target, although some orders entered during the disruption require reconciliation. The company does not pay the ransom. Post-incident review identifies that technical controls alone were insufficient: payment procedures, identity governance, supplier verification and tested recovery were equally important.

Learning Points

The case demonstrates that attacks often progress through several weaknesses rather than one failure. MFA, segmentation, protected backups and user reporting reduce the probability and impact of compromise. RTO and RPO must be derived from business needs, and recovery capability must be demonstrated through testing rather than assumed from the existence of backup files.

Challenges and Limitations

No single control eliminates cyber risk. MFA can be bypassed through session theft or social engineering; encryption fails if keys are mishandled; patches may be unavailable for legacy systems; backups may contain corrupted data; and firewalls cannot prevent authorized users from misusing access. Security controls also impose cost, complexity and possible usability burdens. Excessive restrictions can encourage users to create workarounds.

Risk changes as technologies, suppliers, regulations and attacker methods change. Cloud adoption shifts some infrastructure responsibility to providers but does not remove the customer’s responsibility for configuration, identities, data and continuity. Effective programs therefore require continuous assessment, measurable ownership, testing and improvement.

Best-Practice Checklist

Chapter Summary

Cybersecurity protects confidentiality, integrity and availability, while privacy governs the fair and appropriate handling of personal information. Resilient computing combines prevention with the ability to withstand, respond to and recover from disruption. Threats exploit vulnerabilities through malware, social engineering, stolen credentials, denial-of-service, injection and interception attacks. Effective defense is layered: MFA and least privilege protect identity; encryption protects data; patching and secure configuration reduce exploitable weaknesses; firewalls and segmentation restrict traffic; and protected, tested backups support recovery.

Incident response requires preparation, detection, containment, eradication, recovery and learning. Business continuity maintains essential services through people, processes, facilities and suppliers, whereas disaster recovery focuses on restoring technology and data. A business impact analysis establishes priorities, RTO and RPO. Because controls have limitations, responsible security also requires governance, ethical treatment of personal data, legal awareness, supplier oversight and continuous testing.

Key Terms

Authorization: Determination of what an authenticated identity may access or do.

Business continuity: Capability to continue essential products and services during disruption.

Business impact analysis: Process for identifying consequences, priorities and recovery requirements for disrupted activities.

CIA triad: Confidentiality, integrity and availability objectives of information security.

Encryption: Transformation of plaintext into ciphertext using an algorithm and key.

Firewall: A control that permits or blocks network traffic according to defined rules.

Incident response: Coordinated preparation, analysis, containment, eradication, recovery and learning after a security incident.

Least privilege: Providing only the access necessary for an authorized task.

Malware: Software intended to harm, spy on, disrupt or gain unauthorized access.

Multi-factor authentication: Authentication using two or more different factor categories.

Patch management: Controlled identification, testing, deployment and verification of updates.

Phishing: Deceptive communication intended to induce unsafe action or disclosure.

Privacy: Appropriate governance of personal information collection, use, sharing and retention.

Recovery point objective: Maximum acceptable period of data loss measured backward from disruption.

Resilience: Capacity to withstand disruption, recover operations and learn from events.

Social engineering: Manipulation of people to obtain access, information or action.

Review Questions

Short Answer Questions

Long Answer Questions

Analytical / Application Questions

Multiple Choice Questions with Answers

Question 1

Which objective is violated when an unauthorized person changes inventory records?

Question 2

Question 3

Question 4

Question 5

Correct Answer: C. Hashing produces a digest and is not designed for decryption

Question 6

Which control most directly reduces exploitation of a known operating-system vulnerability?

Question 7

Question 8

Question 9

Which incident-response phase removes malware and closes the exploited weakness?

Chapter 13 Cybersecurity, Privacy and Resilient Computing

Cybersecurity, Privacy and Resilient Computing

Introduction